# Log4j input

**URL:** <https://discuss.elastic.co/t/log4j-input/33557>\
**Category:** Logstash\
**Created:** [November 2, 2015, 6:59pm UTC](https://discuss.elastic.co/t/log4j-input/33557 "2015-11-02T18:59:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sbecker](https://avatars.discourse-cdn.com/v4/letter/s/f05b48/32.png) [@sbecker](https://discuss.elastic.co/u/sbecker)\
**Post date:** [November 2, 2015, 6:59pm UTC](https://discuss.elastic.co/t/log4j-input/33557/1 "2015-11-02T18:59:20Z")

</div>

I have tried to input several log4j messages, generated by our internal apps, into logstash with no luck. If I can to a TCP input on port 4560, it works. Do I need a specific log4j message format?

I have searched extensively and read this page:

[https://www.elastic.co/guide/en/logstash/current/plugins-inputs-log4j.html#plugins-inputs-log4j-type?q=log4j](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-log4j.html#plugins-inputs-log4j-type?q=log4j)

But no luck so far.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 2, 2015, 7:13pm UTC](https://discuss.elastic.co/t/log4j-input/33557/2 "2015-11-02T19:13:44Z")

</div>

Are you using SocketAppender on the Java side? That's what the log4j input is meant to be used with.

---

<div class="post-metadata">

**Author:** ![sbecker](https://avatars.discourse-cdn.com/v4/letter/s/f05b48/32.png) [@sbecker](https://discuss.elastic.co/u/sbecker)\
**Post date:** [November 2, 2015, 10:30pm UTC](https://discuss.elastic.co/t/log4j-input/33557/3 "2015-11-02T22:30:31Z")

</div>

Yes, I had a Java Dev add the socketappender code to one of our apps. I have been testing with nc (netcat) as well.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 3, 2015, 7:50am UTC](https://discuss.elastic.co/t/log4j-input/33557/4 "2015-11-03T07:50:04Z")

</div>

IIRC the log4j input expects to receive serialized Java objects in which case netcat tests aren't very useful.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:24am UTC](https://discuss.elastic.co/t/log4j-input/33557/5 "2017-07-06T05:24:24Z")

</div>